1 / 42

Programmers Ain’t Mathematicians and Neither Are Testers

Programmers Ain’t Mathematicians and Neither Are Testers. Jeff Offutt Software Engineering George Mason University Fairfax, VA USA www.cs.gmu.edu/~offutt/ offutt@gmu.edu. ICFEM – 10 Year Anniversary. ICFEM 1 – 1997 in Hiroshima

chill
Télécharger la présentation

Programmers Ain’t Mathematicians and Neither Are Testers

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Programmers Ain’t Mathematicians and Neither Are Testers Jeff Offutt Software Engineering George Mason University Fairfax, VA USA www.cs.gmu.edu/~offutt/ offutt@gmu.edu

  2. ICFEM – 10 Year Anniversary • ICFEM 1 – 1997 in Hiroshima • Florida, Macau, Manchester, Seattle, Singapore, Shanghai, York, Brisbane, Hiroshima The challenge is to scale up formal methods and integrate them into engineering development processes ... bring together those interested in the application of formal engineering methods to computer systems. • Great papers on engineering of formal methods • Growth of this conference has proved it to be an undeniable success © Jeff Offutt, 2008

  3. Why Formal Methods? • NASA’s Mars lander, September 1999, crashed due to a units integration fault—over $50 million US ! • Huge losses due to web application failures • Financial services : $6.5 million per hour • Credit card sales applications : $2.4 million per hour • In Dec 2006, amazon.com’sBOGO offer turned into a double discount • Symantec says that most security vulnerabilities are due to faulty software • Formal methods could solve most of these problems World-wide monetary loss due to poor software is staggering © Jeff Offutt, 2008

  4. Evolving From Formal Methods • BS in Mathematics • I fell in love with abstract algebra and programming • to … MS / PhD in Computer Science • I was shocked at how hard it was to build bad software – and wondered how to make it easier to build good software • to … Research in Software Engineering • Applying math to build high quality software • Not just efficiency, but reliability, maintainability, usability, security, … © Jeff Offutt, 2008

  5. Specification-Based Testing (SBT) • In the early 1990s I got interested in algebraic specifications • Taught in several courses • Wrote an NSF proposal on spec-based testing • Eventually concluded : • Very hard to scale algebraic specs beyond stacks and queues • Nobody in industry would use them • Later Paul Ammann and I did some work on generating tests from Z specifications • But I had to re-learn the syntax every time I saw a Z spec • The strongest part of that paper was in input space partitioning–in particular, the base choice criteria • This led to an interest in state-based specifications © Jeff Offutt, 2008

  6. State-Based Specifications • In the mid-1990s I started looking at test criteria on state-based specifications • Steve Miller and Dave Statezni from Rockwell-Collins asked for help • They had specifications in SCR • The U.S. Federal Aviation Administration (FAA) required them to apply MCDC to code so I started there Multiple Condition Decision Coverage (MCDC): MCDC requires that each condition in a decision be shown by execution to independently affect the outcome of the decision. — Chilenski & Miller, RTCA-DO-178B © Jeff Offutt, 2008

  7. MCDC Problems What does “independently effect the outcome” mean ? What does “show by execution” mean ? • In p = a  (b  c), a determines p when (bc) = (tt), (tf), or (ft) • Which one ? • Must b and c be the same when a=t and when a=f ? • What if p has the same value when a=t and when a=f ? Full Predicate Coverage (FP) : For each clause c in p, c must control the value of p (c and p are “correlated”) — Offutt, Xiong and Liu, ICECCS, 1999 FP does not require the predicate to have different values © Jeff Offutt, 2008

  8. Active Clause Coverage • Later Paul Ammann and I revisited this controversy Active Clause Coverage (ACC) : For each clause c in p, the otherclauses have values so thatcdetermines p. and p must be true for one value of c and false for the other — Ammann and Offutt, ISSRE 2003 • Two variations : • Restricted Active Clause Coverage (RACC): The values for the other clauses must be the same with both values for c • Correlated Active Clause Coverage (CACC) : The values for the other clauses can be different with both values for c • Clearer terminology, no ambiguity © Jeff Offutt, 2008

  9. SPC & Model-Based Testing • In 1999 I adapted full predicate to UML statechartsfor Rockwell-Collins • Now the field of model-based testing is quite active with dozens of papers every year • In my many visits to Rockwell-Collins, I realized • The engineers hated MCDC, FP, and the FAA requirements • They often took shortcuts • Hand computations were incredibly expensive and error-prone Programmers ain’t mathematicians ! • We cannot make programmers use formal methods • What are the underlying differences ? © Jeff Offutt, 2008

  10. Math, CS, Software Engineering • We got into trouble because Computer Science was largely created by Mathematicians • Seeking perfect answers, not engineeringsolutions • And with the name “computer science” … we tried too hard to be “scientists” • Remember the original purpose of formal methods? • We naively thought we could “formally prove” programs to be “correct” • Just like a geometry theorem … • Science, Math and Computing are related … © Jeff Offutt, 2008

  11. Goals of Science and Engineering observe achieve find and describe design and develop Structures Behaviors Science Engineering © Jeff Offutt, 2008

  12. Computing is Different Behaviors Behaviors observe achieve Science Engineering find and describe design and develop achieve Structures design and develop model imagine Structures Computing © Jeff Offutt, 2008

  13. The Changing Face of Computing • 1982 • 80% of people in IT industry were programmers • CS curricula were based on the research interests of the faculty (automata, OS, compilers, AI, … ) • 2008 • < 20% of people in IT are programmers • Industry and research interests have diverged • CS departments struggle to get people to teach compilers • Curricula have changed very little – added networks and graphics © Jeff Offutt, 2008

  14. Historical Perspective Biology Civil Chemistry ECE Physics Math 1800s Mechanical etc. Physics 1900s etc. Computer Science 2000s Computing ??? © Jeff Offutt, 2008

  15. Possible Computing Fields (2020) Software Engineering Computer Science Networking Information Technology Artificial Intelligence Games & Graphics Information Systems programming, algorithms, analysis, design programming, algorithms, creativity math, programming, algorithms theory, algorithms, programming no math no programming analysis, design, programming analysis, problem solving, design © Jeff Offutt, 2008

  16. Evolution of Formalism in Software Engineering • 1970s : Attempts to “prove” programs work “correctly” • The proof always comes back false –then what ? • What is “correctness” ? Is a train correct ? • Proofs are social processes, not automated … nobody wants to read proofs of programs • 1980s—1990s : Formal specifications • Mathematical descriptions of behavior • Specification-based testing • 1990s—2000s : Semi-formal modeling • Usually no formal semantics • Model-based testing © Jeff Offutt, 2008

  17. Key Difference What software does How software does it Definitional Procedural Z VDM CSP CCSHOL LOTOS SOFL FSMs PNs Lisp APL C Java Statecharts Crossing the “What / How” barrier is very hard !! © Jeff Offutt, 2008

  18. What Versus How TT TF FT FF We’ve been trying for 30 years to cross this barrier ! Engineers think procedurally abouthow Mathematicians thinkdefinitionallyaboutwhat MODULE main #define false 0 #define true 1 VAR x, y : boolean; ASSIGN init (x) := false; init (y) := false; next (x) := case !x & y : true; !y : true; x : false; true : x; esac; next (y) := case x & !y : false; x & y : y; !x & y : false; true : true; esac; © Jeff Offutt, 2008

  19. What Can We Do ? • “Make” engineers use formal methods ? • We do not have that power … • and … they ain’t mathematicians … • Teach them formal methods are better ? • It’s been a hard sell for a very long time … • and … they ain’t mathematicians … • Give up ? • “if you can’t beat ‘em, join ‘em” • Infiltrate them … • They ain’t mathematicians But they don’t need to be !!! © Jeff Offutt, 2008

  20. Three Approaches • Isolate • One mathematician supporting a group of engineers • An “enabler” to cross the barrier • Disguise • Refine the formal methods into engineering techniques • Hide the math in programming standards, frameworks or language features • Embed • Put the math into tools • Hide them in processes All this science, I don't understand It's just my job, 5 days a week. A rocket man! – Elton John © Jeff Offutt, 2008

  21. 1. Isolate • Building construction takes a lot of math • Civil engineers eat math at every meal for four years in college • But in construction … one civil engineer and hundreds of other professionals … • And the theory part ? • Maybe one physicist for 1000 engineers ! • Why should everyone learn formal methods ? © Jeff Offutt, 2008

  22. 1. Isolation in Software Testing • At George Mason, Paul Ammann and I have been teaching software testing to MS students for 20 years • Previous book (Beizer) went out of print in 2002 • So we started writing our own Introduction to Software Testing, Cambridge Press, 2008 • Along the way, we completely inverted the way testing is taught … • Resulting in a completely different way to apply formal engineering methods to testing … © Jeff Offutt, 2008

  23. Types of Test Activities • Testing can be broken up into four general types of activities • Test Design • Test Automation • Test Execution • Test Evaluation • Each type of activity requires different skills, background knowledge, education and training • No reasonable software development organization uses the same people for requirements, design, implementation, integration and configuration control • 1.a) Criteria-based • 1.b) Human-based Why do test organizations still use the same people for all four test activities?? This clearly wastes resources © Jeff Offutt, 2008

  24. Summary of Test Activities • These four general test activities are quite different • It is a poor use of resources to use people inappropriately Most test teams use the same people for ALL FOUR activities !! © Jeff Offutt, 2008

  25. Model-Driven Test Design – Steps criterion refine refined requirements / test specs model / structure test requirements generate analysis DESIGN ABSTRACTION LEVEL IMPLEMENTATION ABSTRACTION LEVEL software artifact input values prefix postfix expected execute evaluate automate pass / fail test results test scripts test cases © Jeff Offutt, 2008

  26. MDTD – Activities refined requirements / test specs Here be math model / structure test requirements Test Design Test Design DESIGN ABSTRACTION LEVEL Raising our abstraction level makes test design MUCH easier IMPLEMENTATION ABSTRACTION LEVEL software artifact input values Test Automation Effective, efficient, isolation of formal engineering pass / fail test results test scripts test cases Test Evaluation Test Execution © Jeff Offutt, 2008

  27. 1. Using MDTD to Isolate • This approach lets one mathematician do the math • Test design • Then testers and programmers can do their parts • Find values • Automate the tests • Run the tests • Evaluate the tests Testers ain’t mathematicians ! © Jeff Offutt, 2008

  28. Three Approaches • Isolate • One mathematician supporting a group of engineers • An “enabler” to cross the barrier • Disguise • Refine the formal methods into engineering techniques • Hide the math in programming standards, frameworks or language features • Embed • Put the math into tools • Hide them in processes All this science, I don't understand It's just my job, 5 days a week. A rocket man! – Elton John © Jeff Offutt, 2008

  29. 2. Disguise • Building construction uses many standards • They have “codes” for where door knobs go, how many electrical outlets to use, doors, … • Team foremen know the standards, but workers often do not • Software engineering needs to disguise formal methods into engineering techniques & processes • This is how design-by-contracts started © Jeff Offutt, 2008

  30. 2. Disguising in Programming • The first course in our MS in Software Engineering is Object-Oriented Design and Construction • We teach type theory, representation invariants, polymorphism theory, component specification, and refinement • All formal methods topics … But the students think it’s a programming class !!! • Instead of teaching the math directly, we teach them proper design and programming techniques • The formalism is refined into practical programming guidelines • This is a math class … in disguise ! © Jeff Offutt, 2008

  31. 2. Stealthy Formal Methods Class • This stealthy approach is greatly helped by two books: • Liskov with Guttag, Program Development in Java • Bloch, Effective Java • Liskov, of course, invented much of type theory • This book explains how to build OO classes and type hierarchies that are type-safe (among other things) • Bloch teaches how OO program components can safely interact without violating formal requirements • Students who later take a formal methods class are thrilled to see the theory behind the practice • Learning theory in front of practice is for mathematicians Programmers ain’t mathematicians ! © Jeff Offutt, 2008

  32. 2. Disguising Abstract Algebra • In 1980, as a 3rd year math major, I took a class in Abstract Algebra • Group theory, rings, homomorphisms … • Fun stuff ! (for a mathematician) • Midway through, I discovered that abstract algebras can be used to represent the Rubik’s cube • And developed an algebra to solve it • Data structures are informal algebraic • groups • But well disguised ! Programmers ain’t mathematicians ! © Jeff Offutt, 2008

  33. Three Approaches • Isolate • One mathematician supporting a group of engineers • An “enabler” to cross the barrier • Disguise • Refine the formal methods into engineering techniques • Hide the math in programming standards, frameworks or language features • Embed • Put the math into tools • Hide them in processes All this science, I don't understand It's just my job, 5 days a week. A rocket man! – Elton John © Jeff Offutt, 2008

  34. 3. Embed • Building construction is starting to use pre-fabricated modular units • The units save time • They also allow the math to be embedded in the units • Standards, stress, … • Software engineering needs to embed formal methods in languages, components, processes • Isn’t that what strong typing is ? © Jeff Offutt, 2008

  35. Data Structures and Frameworks • When I was a professional programmer, we built data structures out of pointers, records and arrays • Mistakes allowed structures to have invalid states • The formal specs, although not explicitly stated, were not always satisfied • Frameworks like the Java Collectionsembed the formal specs into software so programmers do not have to understand them • Programmers can now use data structures without knowing how to build them • The use of frameworks is expanding—very common now in web applications © Jeff Offutt, 2008

  36. Embedding Math in Testing Tools • In specification-based testing : • Each clause is tested separately when it determines the value of the predicate (CACC ) Determination : Clause ci in predicate p, the major clause, determinesp if and only if values for the remaining minor clausescj are such that changing ci changes the value of p • Boolean Derivatives: • pc=true is p with every occurrence of c replaced by true • pc=false is p with every occurrence of c replaced by false • To find minor clause values for c to determine the value, solve the following: pc = pc=true pc=false © Jeff Offutt, 2008

  37. Embedding into Tools pc = pc=true pc=false • This is not very difficult • But there is no reason for all testers to know this ! • Embed this computation in a tool : p = a  (b  c) pa = pa=truepa=false = (true  (b c))  (false  (b c)) = true  (b c) = ¬ (b c) = ¬b ¬c http://cs.gmu.edu:8080/offutt/coverage/LogicCoverage Testers ain’t mathematicians ! © Jeff Offutt, 2008

  38. Agenda for Researchers Teachers Practitioners © Jeff Offutt, 2008

  39. Agenda for Researchers • Invent processes and techniques that isolate math so that only a few individuals need to use it • Discover engineering techniques, standards and frameworks that disguise the math • Develop more clever ways to embed the math into tools and processes • Empirically validate the benefits of formal methods • Industry doesn’t believe they help ! • Do you know they help, or only believe ? © Jeff Offutt, 2008

  40. Agenda for Teachers • Teach classes to engineers that disguise the math • We must understand both sides • We need to become enablers • Ask ourselves when math is needed • And when it can be omitted (isolated, disguised, embedded) • Restructure our curricula so that we teach the needed math to a few • And don’t make the rest suffer © Jeff Offutt, 2008

  41. Agenda for Practitioners • Organize test and QA teams to make effective use of individual abilities • One math-head can support many testers • Think carefully about who should create formal models and how they interact with programmers • Encourage researchers to embed and isolate • We are very responsive to research grants … • Get involved in curricular design efforts through industrial advisory boards © Jeff Offutt, 2008

  42. Contact Jeff Offutt offutt@gmu.edu http://cs.gmu.edu/~offutt/ Domo arigato gozaimashta © Jeff Offutt, 2008

More Related